South Korea expands internet censorship to HTTPS with first countrywide use of SNI filtering
Previously, the Korea Communications Standards Commission (KCSC) used Domain name System (DNS) filtering to ferret out which domains users were trying to visit, compare them to the blacklist, and redirect them to the warning site if needed. This basic DNS filtering was defeatable by using a different DNS server or visiting the HTTPS versions of websites. Now, to combat that, South Korea’s internet service providers are adding server name indication (SNI) filtering. A browser’s SNI request can be used to identify the destination hostname (domain) and then the filtering happens. Some browsers do support encrypted SNI requests; however, most websites do not currently. Furthermore, according to Cloudflare’s Nick Sullivan, South Korea seems to be blocking encrypted SNI automatically.
And it looks like they're blocking encrypted SNI outright (according to accounts on the ground). In some ways, this is our fault for not agreeing on a final spec and pushing it out to more clients faster. The politics around network privacy engineering are tricky. Cliffs abound. https://t.co/INnCS25akO
— Nick Sullivan (@grittygrease) February 13, 2019
The KCSC has obligated Korean internet service providers (ISPs) to filter all SNI requests, essentially giving them an unencrypted list of all websites visited from within South Korea. This is just one of myriad censorship vectors that are available for use in South Korea. What’s worse, since ESNI is blocked entirely there isn’t a quick, easy fix like there was when South Korea’s internet censorship list only utilized DNS filtering. SNI filtering is a relatively new censorship technique on a global scale, at least according to the IETF’s latest paper on internet censorship techniques from around the world. Until the internet itself is more robust and ESNI becomes an official IETF standard, expect more Koreans to discover the benefits of a private VPN.
Koreans speak up against South Korean internet censorship
This ramping up of government censorship has not gone unnoticed by Korean netizens. An official government petition against the SNI packet inspection has garnered over 100,000 signatures, though it’s unclear how the South Korean government will react to the popular petition. Others compare it to Korea’s censorship efforts to the beginnings of the Great Firewall of China. After all, they came for the porn first there, as well. All around the world, we see the same censorship creeping up using the “think of the children” argument. They’re wrong every time and will continue to be. As internet access in certain countries become more restrictive, the importance of privacy grows stronger.
Written with contributions from Derek Zimmer.